🔊 cidr: log the decisions dropped for an unparsable CIDR

SetCIDR and DeleteCIDR returned silently when NormalizeCIDR rejected the
value, so a range decision the plugin does not understand is not enforced
and nothing says why. Every other operation of the package logs, and this
one fails open, which is the direction worth shouting about.

Log at Error with the raw value and what the consequence is, so an
unexpected decision format shows up in the logs instead of looking like a
decision that was applied.

pkg/cache/cache.go

@@ -162,10 +162,12 @@ func (c *Client) Set(key string, value string, duration int64) {
 
 // DeleteCIDR removes a CIDR decision from the cache.
 func (c *Client) DeleteCIDR(cidr string) {
-	cidr = ip.NormalizeCIDR(cidr)
-	if cidr == "" {
+	normalized := ip.NormalizeCIDR(cidr)
+	if normalized == "" {
+		c.log.Error(fmt.Sprintf("cache:DeleteCIDR:invalidCIDR cidr:%v decision is left in cache", cidr))
 		return
 	}
+	cidr = normalized
 	c.cache.delete(cidrPrefix + cidr)
 	c.log.Debug(fmt.Sprintf("cache:DeleteCIDR cidr:%v", cidr))
 }
@@ -191,6 +193,7 @@ func (c *Client) SetCIDR(cidr, value string, duration int64) {
 	normalized := ip.NormalizeCIDR(cidr)
 	prefixLen := ip.CIDRPrefixLen(cidr)
 	if normalized == "" || prefixLen < 0 {
+		c.log.Error(fmt.Sprintf("cache:SetCIDR:invalidCIDR cidr:%v value:%v decision is not enforced", cidr, value))
 		return
 	}
 	// Publish the length first, or a concurrent lookup misses the decision.